diff --git a/packages/core/basic/src/utils/util.log.ts b/packages/core/basic/src/utils/util.log.ts
index fbcc87e2e..a106b82d3 100644
--- a/packages/core/basic/src/utils/util.log.ts
+++ b/packages/core/basic/src/utils/util.log.ts
@@ -77,6 +77,8 @@ export type ILogger = {
   fatal(message: any, ...args: any[]): void;
 
   mark(message: any, ...args: any[]): void;
+
+  addSecret(secret: string): void;
 };
 
 const locale = Intl.DateTimeFormat().resolvedOptions().locale;
@@ -106,10 +108,14 @@ export class PipelineLogger implements ILogger {
 
   constructor(name: string, write: (text: string) => void) {
     this.customWriter = write;
+    //@ts-ignore
     this.logger = log4js.getLogger(name);
   }
 
   addSecret(secret: string) {
+    if (!secret) {
+      return;
+    }
     this._secrets.push(secret);
   }
 
diff --git a/packages/ui/certd-server/src/plugins/plugin-cert/plugin/cert-plugin/base.ts b/packages/ui/certd-server/src/plugins/plugin-cert/plugin/cert-plugin/base.ts
index fa89aae46..24499090e 100644
--- a/packages/ui/certd-server/src/plugins/plugin-cert/plugin/cert-plugin/base.ts
+++ b/packages/ui/certd-server/src/plugins/plugin-cert/plugin/cert-plugin/base.ts
@@ -60,6 +60,7 @@ export abstract class CertApplyBasePlugin extends CertApplyBaseConvertPlugin {
   abstract doCertApply(): Promise<CertReader>;
 
   async execute(): Promise<string | void> {
+    this.logger.addSecret(this.pfxPassword);
     const oldCert = await this.condition();
     if (oldCert != null) {
       await this.output(oldCert, false);